bug: Add missing trivy/grype scan to reusable build flavor workflow

[Itxaka]

Currrently only release job has the Trivy/Grype scan

We should add it to the reusable-build-flavor workflow to scan the created images on each MASTER push, upload them to the security tab on github so we can track issues.

[jimmykarily]

Let's do it only on master runs because the notifying us on every PR and blocking the merge doesn't make sense. We care about CVEs at release time.

[Itxaka]

Let's do it only on master runs because the notifying us on every PR and blocking the merge doesn't make sense. We care about CVEs at release time.

sorry I wanted to write that, but seems like I did NOT. woops